From mboxrd@z Thu Jan 1 00:00:00 1970 From: oliver.fuhrer@bluewin.ch To: development@lists.ipfire.org Subject: RE: Forward default "DROP" is not applied to ORANGE traffic?! Date: Sun, 16 Dec 2018 18:07:16 +0100 Message-ID: <000201d49561$cbd83ea0$6388bbe0$@bluewin.ch> In-Reply-To: MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="===============4739908155821244226==" List-Id: --===============4739908155821244226== Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Hi Michael, I observed the same issue on my installations and I think it's coming from th= e following lines in /etc/rc.d/init.d/firewall: 413 # Orange pinholes 414 if [ "$ORANGE_DEV" !=3D "" ]; then 415 # This rule enables a host on ORANGE network to connect t= o the outside 416 # (only if we have a red connection) 417 if [ "$IFACE" !=3D "" ]; then 418 iptables -A REDFORWARD -i $ORANGE_DEV -o $IFACE -= j ACCEPT 419 fi 420 fi Regards Oliver -----Original Message----- From: Development On Behalf Of Micha= el Tremer Sent: Sunday, December 16, 2018 2:53 PM To: Peter M=C3=BCller Cc: IPFire: Development-List Subject: Re: Forward default "DROP" is not applied to ORANGE traffic?! Hey, Could you dump the generated iptables ruleset? I do not see anything that could potentially be a problem here that is causin= g your behaviour: https://git.ipfire.org/?p=3Dipfire-2.x.git;a=3Dblob;f=3Dconfig/firewall/fir= ewall-policy;h=3D078c3c515c31f1f385a2159f83fb5c6c52f5e89f;hb=3DHEAD -Michael > On 15 Dec 2018, at 16:36, Peter M=C3=BCller wro= te: >=20 > Hello list, >=20 > I recently stumbled across a strange behaviour of IPFire 2.x, which > seems to be quite critical in my eyes, but I am not sure whether it is > intentional or not. >=20 > Default settings of IPFire allow traffic from internal networks > (GREEN, BLUE, ORANGE) to the internet (RED), as documented here: > https://wiki.ipfire.org/configuration/firewall/default-policy >=20 > For several reasons, no direct internet access is desired on most > firewall installations I administer, so setting the "default firewall > behaviour" to DROP for both FORWARD and OUTGOING usually is one of > the first steps after installation. >=20 > Speaking about GREEN and BLUE, this seems to work: No direct connection > is possible except it has been explicitly allowed. >=20 > It turns out this setting does not apply to traffic from ORANGE: Even > default is set to DROP, and no firewall rules allowing anything are > in place, a server located in DMZ is able to reach full internet - > every port on every IP in every country. >=20 > This is not my expectation of "default policy" =3D DROP after all! >=20 > Could somebody of the core developers urgently have a look at this, please? >=20 > Thanks, and best regards, > Peter M=C3=BCller > --=20 > Microsoft DNS service terminates abnormally when it recieves a response > to a DNS query that was never made. Fix Information: Run your DNS > service on a different platform. > -- bugtraq --===============4739908155821244226==--